Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency cilium/cilium to v1.14.4 #2079

Merged
merged 1 commit into from Nov 20, 2023

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 2, 2023

cilium/cilium#27841 changed how the routing mode gets set for GKE, and
now it always gets set to "native". Use --datapath-mode flag to force
the tunnel mode for the external workload test since that's the only
configuration that's known to work 1.

Fixes: #2070

Signed-off-by: renovate[bot] bot@renovateapp.com
Signed-off-by: Michi Mutsuzaki michi@isovalent.com

Mend Renovate logo banner

This PR contains the following updates:

Package Update Change
cilium/cilium patch v1.14.2 -> v1.14.4

Release Notes

cilium/cilium (cilium/cilium)

v1.14.4: 1.14.4

Compare Source

We are pleased to release Cilium v1.14.4. This release includes several network policy performance improvements, improvements and fixes for IPSec, and numerous bug fixes and architectural improvements.

Summary of Changes

Minor Changes:

  • certmanager: solve CannotRegenerateKey (Backport PR #​29030, Upstream PR #​28787, @​universam1)
  • Cilium DNS proxy now uses the original pod's address as the source address towards the DNS servers. (Backport PR #​29086, Upstream PR #​28928, @​jrajahalme)
  • Cilium now properly deletes stale (deleted) nodes from the node_connectivity_status and node_connectivity_latency_seconds metrics, reducing metric cardinality. (Backport PR #​28980, Upstream PR #​28382, @​derailed)
  • Display interfaces used for IPsec decryption in cilium encrypt status. (Backport PR #​28759, Upstream PR #​28640, @​pchaigno)
  • helm: delete AWS iptables in all deployments aside from AWS CNI chaining environments (Backport PR #​28870, Upstream PR #​28697, @​nebril)
  • ipsec: New Prometheus metrics for XFRM configs (Backport PR #​28759, Upstream PR #​28400, @​pchaigno)
  • policy: Cilium will not process or enforce network policies with port ranges or Kubernetes network policies that use "EndPort". (Backport PR #​29030, Upstream PR #​28704, @​nathanjsweet)
  • policy: Fixed a bug that incorrectly omitted port-protocol policy rules that omitted the "protocol" field. An omitted "protocol" field now, correctly, is the same as using the "ANY" protocol. (Backport PR #​28759, Upstream PR #​28703, @​nathanjsweet)
  • v1.14: WG tunneling (#​28917, @​brb)

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

v1.14.3: 1.14.3

Compare Source

We are pleased to release Cilium v1.14.3. This is bug fix release addressing the recent HTTP/2 Stream Cancellation Attack (CVE-2023-44487) and other bugs:

Summary of Changes

Minor Changes:

Bugfixes:

  • bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes (Backport PR #​28123, Upstream PR #​27798, @​ti-mo)
  • bpf: overlay: fix missing DBG_DECAP for Inter-Cluster-SNAT (Backport PR #​28494, Upstream PR #​28466, @​julianwiedmann)
  • Change routing-mode and tunnel-protocol based on .Values.tunnel and .Values.routingMode (Backport PR #​28282, Upstream PR #​27841, @​macmiranda)
  • datapath: fix NodePort to remote hostns backend with tunnel config (Backport PR #​28494, Upstream PR #​27323, @​michaelasp)
  • envoy: Sync supported resources to fix not found issue (Backport PR #​28349, Upstream PR #​28272, @​sayboras)
  • Fix a bug that causes pod-to-pod traffic between nodes to be dropped when IPsec is enabled and kube-proxy installed rules in both iptables-nft and iptables-legacy. (Backport PR #​28442, Upstream PR #​28258, @​pchaigno)
  • fix bug: pull skb data in cil_from_netdev path for HIGH_SCALE_IPCACHE mode (Backport PR #​28095, Upstream PR #​27913, @​sofat1989)
  • Fix Gateway API HttpRoute cannot strip path prefix. (Backport PR #​28282, Upstream PR #​28018, @​chaunceyjiang)
  • Fix hubble metric labeling when only directed Source/Destination Ingress/Egress options are specified. (Backport PR #​28095, Upstream PR #​27792, @​marqc)
  • Fix minor bug where the previous Cilium proxy port was not reused (Backport PR #​28127, Upstream PR #​27634, @​christarazi)
  • Fix the trace notification for hairpinned reply traffic, to indicate the correct security identity for the client. (Backport PR #​28282, Upstream PR #​28133, @​julianwiedmann)
  • Fix wrong host and router IP being used for some IPv6 deployments, which was causing various connectivity problems. (Backport PR #​28435, Upstream PR #​28417, @​ti-mo)
  • Fix: Gateway API double slash while stripping path prefix (Backport PR #​28442, Upstream PR #​28294, @​nxy7)
  • Fixes a bug causing panic when counting IPsec keys number via "cilium encrypt status". (Backport PR #​28282, Upstream PR #​27996, @​jschwinger233)
  • fqdn proxy: fix data race by using separate sessionUDPFactories (Backport PR #​28282, Upstream PR #​28163, @​mhofstetter)
  • ipam/multipool: Fix bug where allocator was unable to update CiliumNode (Backport PR #​28095, Upstream PR #​27963, @​gandro)
  • ipcache: fix flapping labels in SelectorCache when reserved:host identity has multiple IPs (Backport PR #​28418, Upstream PR #​28332, @​squeed)
  • Must have port for Service reference (Backport PR #​28282, Upstream PR #​27959, @​chaunceyjiang)
  • pkg/k8s: use a deep copy of CNP in UpdateStatus to avoid race condition (Backport PR #​28494, Upstream PR #​28364, @​aanm)
  • pkg/node: Updates GetIPv6AllocCIDRs() to Properly Return Secondary CIDRs (Backport PR #​28095, Upstream PR #​27855, @​danehans)
  • resource: Fix race condition in handling of Kubernetes object delete event retrying. In the very rare case when an object was created, deleted and re-created with the same name and the handling of the first deletion failed, the handling of delete event may have been retried even though the object was re-created. Only affected features using the Resource-library (LB IPAM, Mutual Auth and ClusterMesh). (Backport PR #​28494, Upstream PR #​27340, @​joamaki)
  • Restore host-stack bypass for pod-to-pod traffic in a configuration with kube-proxy, tunnel routing and per-endpoint routes. (Backport PR #​28095, Upstream PR #​27908, @​julianwiedmann)

CI Changes:

Misc Changes:

Other Changes:


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Footnotes

  1. https://docs.cilium.io/en/latest/network/external-workloads/

@renovate renovate bot requested review from a team as code owners November 2, 2023 09:10
@renovate renovate bot added kind/enhancement This would improve or streamline existing functionality. priority/release-blocker This issue will prevent the release of the next version of Cilium. renovate/stop-updating Tell Renovate to stop updating PR labels Nov 2, 2023
@renovate renovate bot temporarily deployed to ci November 2, 2023 09:10 Inactive
@michi-covalent michi-covalent self-assigned this Nov 2, 2023
@michi-covalent
Copy link
Contributor

converting to draft, we need to fix #2070 first.

@michi-covalent michi-covalent marked this pull request as draft November 2, 2023 13:57
@tklauser tklauser removed the priority/release-blocker This issue will prevent the release of the next version of Cilium. label Nov 16, 2023
@renovate renovate bot changed the title chore(deps): update dependency cilium/cilium to v1.14.3 chore(deps): update dependency cilium/cilium to v1.14.4 Nov 17, 2023
cilium/cilium#27841 changed how the routing mode gets set for GKE, and
now it always gets set to "native". Use --datapath-mode flag to force
the tunnel mode for the external workload test since that's the only
configuration that's known to work [^1].

Fixes: #2070

[^1]: https://docs.cilium.io/en/latest/network/external-workloads/

Signed-off-by: renovate[bot] <bot@renovateapp.com>
Signed-off-by: Michi Mutsuzaki <michi@isovalent.com>
@michi-covalent
Copy link
Contributor

✅ successful run: https://github.com/cilium/cilium-cli/actions/runs/6912664044/job/18808649218?pr=2079 removing the temporary commit and marking it ready for review.

@michi-covalent michi-covalent marked this pull request as ready for review November 18, 2023 23:42
Copy link
Member

@sayboras sayboras left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM ✔️

@michi-covalent michi-covalent merged commit ce305f7 into main Nov 20, 2023
17 of 19 checks passed
@michi-covalent michi-covalent deleted the renovate/patch-cilium branch November 20, 2023 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/enhancement This would improve or streamline existing functionality. renovate/stop-updating Tell Renovate to stop updating PR
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CI: external workloads workflow consistently fails in "Verify DNS on VM" step
4 participants